Damages for GDPR Infringements

The Courts have recently provided some helpful guidance regarding claims for non-material damage as a result of an infringement of the Data Protection Act 2018 and the General Data Protection Regulations (“GDPR”).  Article 82 GDPR provides that any person who has suffered an infringement of their data protection rights has the right to receive compensation for both material and non-material damages. Material damage would normally relate to financial loss. However, neither the GDPR nor the Data Protection Act 2018 gave any guidance on what the term “non-material damage” means.  This resulted in a number of referrals being made by other EU States to the Court of Justice of the European Union (CJEU) for guidance and clarification.

In the case of C-300/21 UL v Osterreichische Post AG the CJEU has held that the mere infringement of the GDPR does not alone give rise to a right to compensation. Three conditions need to be established, a person must to have suffered infringement of the GDPR, they must have suffered damage as a result of the infringement and that there must be a causal link between the damage and infringement. There is no de minimis requirement for non-material damage in order recover compensation.  However, a person must be able to demonstrate that the infringement has had negative consequences for them. It can include cases where a data subject experiences a well-founded fear that their personal data may be subject to dissemination. The extent of compensation is to be determined by each Member State subject to compliance with the principles of equivalence and effectiveness.

In the case of Kaminski v Ballymaguire Foods Limited [2023] IECC 5 Judge O’Connor, in Dublin Circuit Court found that the Defendant had infringed Mr Kaminski’s rights pursuant to the Data Protection Act 2018 and the GDPR by the unlawful processing of CCTV footage. The Court found that Mr Kaminski had suffered from serious embarrassment, sleep loss and negative emotions as a result of the breach and that he was entitled to an award for non-material damages. Judge O’Connor found that Mr Kaminski was genuine in his claim and did not exaggerate the effect of the breach on him. Mr Kaminski was awarded €2,000 in compensation for the effect of the breach. Judge O’Connor indicated in his Judgment that “damages in many cases will probably be modest” and that they could in some cases be valued below €500.

The case of Philip McCabe –v- AA Ireland Ltd [2024] IECC 6 also concerned a claim that the Plaintiff’s rights pursuant to the Data Protection Acts and GDPR had been infringed by unlawful use of CCTV footage by his employer. Judge O’Brien in Dublin Circuit Court found that the Plaintiff’s personal data rights had been infringed and awarded him compensation in the sum of €5,500.

The issue of compensation for non-material damage as a result of an infringement of personal data rights also came before Mr Justice McDonald in the Commercial Court in the case of Nolan & Others –v- Dildar Limited & Others [2024] IEHC 4, in the context of a much larger commercial dispute. Mr Millet, one of the Defendants had supplied the personal data of six of the individual Plaintiffs to a third party. The information had been written on the headed notepaper of a company that was also party to the proceedings, but was personally signed by Mr Millett, a director of the company. He accepted that he had disclosed the information without the consent of the Plaintiffs. The Court found that as the author of the letter, Mr Millett could not escape liability for the unauthorised disclosure of the personal information. The Court indicated that it is well settled law that where a company director procures the commission of a tort, the director will incur personal liability. In measuring the level of compensation to be awarded to the Plaintiffs as a result of the breach, the Court noted that there was no evidence that the disclosure of data had any adverse consequences for the Plaintiffs and that there was no evidence of any actual damage suffered by the Plaintiffs. The Court felt that it was appropriate to make an award of nominal damages to each Plaintiff to mark the fact that there rights were infringed in the sum of €500 to each of the individual Plaintiffs, making €3,000 in total.

Initially, all actions for breach of the Data Protection Act 2018 had to be brought in either the Circuit Court or the High Court. This resulted in significant legal costs being incurred in defending such claims, especially for claims for non-material damages where the value of such claims were usually well within the jurisdiction of the District Court which deals with monetary claims of up to €15,000. The legislation was changed in January 2024 to also provide jurisdiction to the District Court to also deal with such claims. This is a welcome development as the costs of defending these claims will be capped at the District Court scale.

It is also worth noting that the Circuit Court and the High Court have both found that claims for non-material damages for infringement of the GDPR and the Data Protection Act 2018 amount to claims for personal injuries and therefore an application must first be made to the Injuries Resolution Board and if necessary, an Authorisation obtained prior to issuing proceedings at any level. In the recent cases of Keane –v- Central Statistics Office [2024] IEHC 20 and Dillon –v- Irish Life Assurance PLC [2024] IEHC 203 the defendants were successful in having the proceedings dismissed due to a failure of the Plaintiffs to obtain an Authorisation from the Injuries Resolution Board. At present, the decision of Keane –v- Central Statistics Office is currently under appeal to the Supreme Court and further clarification may be forthcoming once the case has been heard.

How can Reddy Charlton help?

Reddy Charlton Solicitors advise clients on data protection claims having considerable experience and a number of experts in the area. For further information contact Deirdre O’Halloran dohalloran@reddycharlton.ie